live-api-audit.mjs

import fs from "node:fs";

function parseEnvFile(filePath) {
  const raw = fs.readFileSync(filePath, "utf8");
  const env = {};

  for (const line of raw.split(/\r?\n/)) {
    const trimmed = line.trim();
    if (!trimmed || trimmed.startsWith("#")) {
      continue;
    }

    const idx = trimmed.indexOf("=");
    if (idx === -1) {
      continue;
    }

    const key = trimmed.slice(0, idx).trim();
    let value = trimmed.slice(idx + 1).trim();
    if (
      (value.startsWith('"') && value.endsWith('"')) ||
      (value.startsWith("'") && value.endsWith("'"))
    ) {
      value = value.slice(1, -1);
    }
    env[key] = value;
  }

  return env;
}

function getConfig() {
  const envFile = process.env.ENV_FILE;
  const fileEnv = envFile ? parseEnvFile(envFile) : {};

  const apiKey = process.env.CSFLOAT_API_KEY || fileEnv.CSFLOAT_API_KEY;
  if (!apiKey) {
    throw new Error("CSFLOAT_API_KEY is required. Set it directly or pass ENV_FILE=/path/to/.env");
  }

  return {
    apiKey,
    baseUrl: process.env.CSFLOAT_BASE_URL || "https://csfloat.com/api/v1",
    auditScope: process.env.CSFLOAT_AUDIT_SCOPE || "core",
    allowLiveMutations: process.env.ALLOW_LIVE_MUTATIONS === "1",
    allowRiskyProbes: process.env.ALLOW_RISKY_PROBES === "1",
    preferredSteamId: process.env.CSFLOAT_STEAM_ID || fileEnv.CSFLOAT_STEAM_ID || null,
    requestDelayMs: Number(process.env.CSFLOAT_REQUEST_DELAY_MS || 1250),
  };
}

function summarizePayload(payload) {
  if (Array.isArray(payload)) {
    return { kind: "array", length: payload.length };
  }

  if (payload && typeof payload === "object") {
    return {
      kind: "object",
      keys: Object.keys(payload).slice(0, 10),
    };
  }

  return {
    kind: typeof payload,
    preview: String(payload).slice(0, 120),
  };
}

function errorSummary(payload) {
  if (payload && typeof payload === "object") {
    return Object.fromEntries(Object.entries(payload).slice(0, 6));
  }

  return String(payload).slice(0, 200);
}

function firstNumericRecordKey(record) {
  if (!record || typeof record !== "object" || Array.isArray(record)) {
    return null;
  }

  const [firstKey] = Object.keys(record);
  if (!firstKey) {
    return null;
  }

  const parsed = Number(firstKey);
  return Number.isFinite(parsed) ? parsed : null;
}

function isExtendedScope(config) {
  return config.auditScope === "extended";
}

function resolveRouteUrl(baseUrl, route) {
  return /^https?:\/\//.test(route) ? route : `${baseUrl}${route}`;
}

const MASKED_INSPECT_LINK_PATTERN =
  /^steam:\/\/run(?:game)?\/730\/\d*\/(?:\+|%20)csgo_econ_action_preview(?: |%20)([0-9A-Fa-f]+)$/i;

function isMaskedInspectLink(value) {
  return typeof value === "string" && MASKED_INSPECT_LINK_PATTERN.test(decodeURIComponent(value));
}

function resolveCurrentInspectLink(item) {
  if (!item || typeof item !== "object") {
    return null;
  }

  if (isMaskedInspectLink(item.serialized_inspect)) {
    return item.serialized_inspect;
  }

  if (isMaskedInspectLink(item.inspect_link)) {
    return item.inspect_link;
  }

  if (typeof item.inspect_link === "string") {
    return item.inspect_link;
  }

  return typeof item.serialized_inspect === "string" ? item.serialized_inspect : null;
}

async function main() {
  const config = getConfig();
  let lastRequestAt = 0;

  async function pacedFetch(url, init) {
    const now = Date.now();
    const waitMs = Math.max(0, config.requestDelayMs - (now - lastRequestAt));
    if (waitMs > 0) {
      await new Promise((resolve) => setTimeout(resolve, waitMs));
    }

    const response = await fetch(url, init);
    lastRequestAt = Date.now();

    if (response.status === 429) {
      await new Promise((resolve) => setTimeout(resolve, Math.max(config.requestDelayMs * 4, 4000)));
    }

    return response;
  }

  async function fetchJson(url, init) {
    let response = await pacedFetch(url, init);

    if (response.status === 429 && init.method === "GET") {
      await new Promise((resolve) => setTimeout(resolve, Math.max(config.requestDelayMs * 4, 5000)));
      response = await pacedFetch(url, init);
    }

    const text = await response.text();
    let data;
    try {
      data = JSON.parse(text);
    } catch {
      data = text;
    }

    return {
      status: response.status,
      ok: response.ok,
      data,
    };
  }

  async function request(method, route, body) {
    const result = await fetchJson(resolveRouteUrl(config.baseUrl, route), {
      method,
      headers: {
        Authorization: config.apiKey,
        Accept: "application/json",
        ...(body ? { "Content-Type": "application/json" } : {}),
      },
      body: body ? JSON.stringify(body) : undefined,
    });

    return {
      method,
      route,
      ...result,
    };
  }

  async function publicRequest(method, route, body) {
    const result = await fetchJson(resolveRouteUrl(config.baseUrl, route), {
      method,
      headers: {
        Accept: "application/json",
        ...(body ? { "Content-Type": "application/json" } : {}),
      },
      body: body ? JSON.stringify(body) : undefined,
    });

    return {
      method,
      route,
      ...result,
    };
  }

  async function companionRequest(method, route, bearerToken, body) {
    const companionBaseUrl = "https://loadout-api.csfloat.com/v1";
    const normalizedRoute = route.startsWith("/") ? route : `/${route}`;
    const result = await fetchJson(resolveRouteUrl(companionBaseUrl, normalizedRoute), {
      method,
      headers: {
        Authorization: `Bearer ${bearerToken}`,
        Accept: "application/json",
        ...(body ? { "Content-Type": "application/json" } : {}),
      },
      body: body ? JSON.stringify(body) : undefined,
    });

    return {
      method,
      route: resolveRouteUrl(companionBaseUrl, normalizedRoute),
      ...result,
    };
  }

  const summary = {
    generated_at: new Date().toISOString(),
    base_url: config.baseUrl,
    audit_scope: config.auditScope,
    allow_live_mutations: config.allowLiveMutations,
    allow_risky_probes: config.allowRiskyProbes,
    request_delay_ms: config.requestDelayMs,
    known_endpoints: [],
    public_no_auth_checks: [],
    market_query_checks: [],
    candidate_endpoints: [],
    mutation_probes: [],
    mutation_checks: [],
  };

  const me = await request("GET", "/me");
  const steamId =
    config.preferredSteamId ||
    (me.ok && me.data && me.data.user ? String(me.data.user.steam_id) : null);
  const tradesPreview = await request("GET", "/me/trades?limit=1");
  const firstTrade = tradesPreview.ok && tradesPreview.data?.trades?.[0]
    ? tradesPreview.data.trades[0]
    : null;
  const offers = await request("GET", "/me/offers?page=0&limit=1");
  const firstOffer = offers.ok && offers.data?.offers?.[0] ? offers.data.offers[0] : null;
  const offerId = firstOffer ? String(firstOffer.id) : null;
  const watchlistPreview = await request("GET", "/me/watchlist?limit=40");
  const watchlistItems =
    watchlistPreview.ok && Array.isArray(watchlistPreview.data?.data)
      ? watchlistPreview.data.data
      : [];
  const notificationsPreview = await request("GET", "/me/notifications/timeline");
  const notificationsCursor =
    notificationsPreview.ok && typeof notificationsPreview.data?.cursor === "string"
      ? notificationsPreview.data.cursor
      : null;
  const firstWatchlistStickerId =
    watchlistItems.find((row) => Array.isArray(row.item?.stickers) && row.item.stickers.length > 0)
      ?.item?.stickers?.[0]?.stickerId ?? null;
  const firstWatchlistKeychainId =
    watchlistItems.find((row) => Array.isArray(row.item?.keychains) && row.item.keychains.length > 0)
      ?.item?.keychains?.[0]?.stickerId ?? null;
  const watchlistStickerFilterQuery =
    firstWatchlistStickerId === null
      ? null
      : encodeURIComponent(JSON.stringify([{ i: firstWatchlistStickerId }]));
  const watchlistKeychainFilterQuery =
    firstWatchlistKeychainId === null
      ? null
      : encodeURIComponent(JSON.stringify([{ i: firstWatchlistKeychainId }]));
  const schemaPreview = await request("GET", "/schema");
  const firstStickerIndex =
    schemaPreview.ok ? firstNumericRecordKey(schemaPreview.data?.stickers) : null;
  const firstKeychainIndex =
    schemaPreview.ok ? firstNumericRecordKey(schemaPreview.data?.keychains) : null;
  const stickerFilterQuery =
    firstStickerIndex === null
      ? null
      : encodeURIComponent(JSON.stringify([{ i: firstStickerIndex }]));
  // Live-confirmed positive probe (2026-03-08): sticker ids 85 and 96 surface souvenir packages.
  const packageProbeStickerFilterQuery = encodeURIComponent(JSON.stringify([{ i: 85 }]));
  // Live-confirmed positive probe (2026-03-08): custom sticker id C10204271498 surfaces coldzera autograph rows.
  const customStickerFilterQuery = encodeURIComponent(JSON.stringify([{ c: "C10204271498" }]));
  const keychainFilterQuery =
    firstKeychainIndex === null
      ? null
      : encodeURIComponent(JSON.stringify([{ i: firstKeychainIndex }]));

  const listings = await request("GET", "/listings?limit=10&type=buy_now");
  const listingRows =
    listings.ok && Array.isArray(listings.data?.data) ? listings.data.data : [];
  const firstListing = listingRows[0] ?? null;
  const inspectListing =
    listingRows.find((listing) => isMaskedInspectLink(resolveCurrentInspectLink(listing?.item))) ||
    listingRows.find((listing) => typeof resolveCurrentInspectLink(listing?.item) === "string") ||
    null;
  const listingId = firstListing ? String(firstListing.id) : null;
  const marketHashName =
    inspectListing?.item?.market_hash_name ||
    firstListing?.item?.market_hash_name ||
    null;
  const inspectSig = inspectListing?.item?.gs_sig || firstListing?.item?.gs_sig || null;
  const inspectLink =
    resolveCurrentInspectLink(inspectListing?.item) ||
    resolveCurrentInspectLink(firstTrade?.contract?.item) ||
    resolveCurrentInspectLink(firstListing?.item) ||
    null;
  const loadouts =
    steamId === null
      ? null
      : await publicRequest("GET", `https://loadout-api.csfloat.com/v1/user/${steamId}/loadouts`);
  const firstLoadout =
    loadouts?.ok && loadouts.data?.loadouts?.[0]
      ? loadouts.data.loadouts[0]
      : null;
  const loadoutId = firstLoadout ? String(firstLoadout.id) : null;

  const knownRoutes = [
    ["GET", "/schema"],
    ["GET", "/schema/browse?type=stickers"],
    ["GET", "/schema/images/screenshot?def_index=7&paint_index=490&min_float=0.15&max_float=0.38"],
    ["GET", "/meta/exchange-rates"],
    ["GET", "/meta/app"],
    ["GET", "/meta/location"],
    ["GET", "/meta/notary"],
    ["GET", "/listings/price-list"],
    ["GET", "https://loadout-api.csfloat.com/v1/loadout?sort_by=favorites&limit=100&months=1&any_filled=true"],
    [
      "GET",
      "https://loadout-api.csfloat.com/v1/loadout?sort_by=favorites&limit=20&months=1&def_index=7&paint_index=490",
    ],
    ...(steamId ? [["GET", `https://loadout-api.csfloat.com/v1/user/${steamId}/loadouts`]] : []),
    ...(loadoutId ? [["GET", `https://loadout-api.csfloat.com/v1/loadout/${loadoutId}`]] : []),
    ["GET", "/me"],
    ["GET", "/me/inventory"],
    ["GET", "/me/account-standing"],
    ["GET", "/me/transactions?limit=1"],
    ["GET", "/me/transactions?page=0&limit=10&order=asc"],
    ["GET", "/me/transactions?page=0&limit=10&order=desc&type=deposit"],
    ["GET", "/me/trades?limit=1"],
    ["GET", "/me/offers?page=0&limit=1"],
    ["GET", "/me/offers-timeline?limit=1"],
    ...(offerId ? [["GET", `/offers/${offerId}`], ["GET", `/offers/${offerId}/history`]] : []),
    ["GET", "/me/watchlist?limit=1"],
    ["GET", "/me/watchlist?limit=1&state=listed"],
    ["GET", "/me/watchlist?limit=1&sort_by=most_recent"],
    ["GET", "/me/watchlist?limit=1&sort_by=highest_discount"],
    ["GET", "/me/watchlist?limit=1&min_ref_qty=20"],
    ["GET", "/me/watchlist?limit=1&type=auction"],
    ["GET", "/me/watchlist?limit=1&type=buy_now"],
    ["GET", "/me/watchlist?limit=1&filter=unique"],
    ...(watchlistStickerFilterQuery
      ? [["GET", `/me/watchlist?limit=1&stickers=${watchlistStickerFilterQuery}`]]
      : []),
    ...(watchlistKeychainFilterQuery
      ? [["GET", `/me/watchlist?limit=1&keychains=${watchlistKeychainFilterQuery}`]]
      : []),
    ["GET", "/me/notifications/timeline"],
    ...(notificationsCursor
      ? [["GET", `/me/notifications/timeline?cursor=${encodeURIComponent(notificationsCursor)}`]]
      : []),
    ["GET", "/me/buy-orders?page=0&limit=1&order=desc"],
    ...(inspectLink && marketHashName && inspectSig
      ? [[
        "GET",
        `/buy-orders/item?url=${encodeURIComponent(inspectLink)}&market_hash_name=${encodeURIComponent(marketHashName)}&sig=${encodeURIComponent(inspectSig)}&limit=3`,
      ]]
      : []),
    ["GET", "/me/auto-bids"],
    ["GET", "/me/mobile/status"],
    ["GET", "/me/payments/pending-deposits"],
    ...(steamId
      ? [
          ["GET", `/users/${steamId}`],
          ["GET", `/users/${steamId}/stall?limit=1&type=buy_now`],
          ["GET", `/users/${steamId}/stall?limit=1&sort_by=lowest_price`],
          ["GET", `/users/${steamId}/stall?limit=1&filter=unique`],
          ["GET", `/users/${steamId}/stall?limit=1&min_ref_qty=20`],
        ]
      : []),
    ["GET", "/listings?limit=1&type=buy_now"],
    ...(listingId ? [["GET", `/listings/${listingId}`]] : []),
    ["GET", "/listings/948726619852374910/bids"],
    ["GET", "/listings/949824804901487637/bids"],
    ["GET", "/listings/948726619852374910/buy-orders"],
    ["GET", "/listings/948726619852374910/similar"],
    ...(marketHashName ? [["GET", `/history/${encodeURIComponent(marketHashName)}/sales`]] : []),
    // history/graph with explicit paint_index
    ["GET", "/history/Souvenir%20P250%20%7C%20Boreal%20Forest%20(Factory%20New)/graph?paint_index=77"],
    // history/graph without paint_index — confirmed live 2026-03-07: route works without explicit paint_index
    ["GET", `/history/${encodeURIComponent("AK-47 | Redline (Field-Tested)")}/graph`],
  ];

  for (const [method, route] of knownRoutes) {
    const result = await request(method, route);
    summary.known_endpoints.push({
      method,
      route,
      status: result.status,
      ok: result.ok,
      summary: summarizePayload(result.data),
    });
  }

  const publicRoutes = [
    ["GET", "/schema"],
    ["GET", "/schema/browse?type=stickers"],
    ["GET", "/schema/images/screenshot?def_index=7&paint_index=490&min_float=0.15&max_float=0.38"],
    ["GET", "/meta/exchange-rates"],
    ["GET", "/meta/app"],
    ["GET", "/meta/location"],
    ["GET", "/meta/notary"],
    ["GET", "/listings/price-list"],
    ["GET", "https://loadout-api.csfloat.com/v1/loadout?sort_by=favorites&limit=100&months=1&any_filled=true"],
    [
      "GET",
      "https://loadout-api.csfloat.com/v1/loadout?sort_by=favorites&limit=20&months=1&def_index=7&paint_index=490",
    ],
    ...(steamId ? [["GET", `https://loadout-api.csfloat.com/v1/user/${steamId}/loadouts`]] : []),
    ...(loadoutId ? [["GET", `https://loadout-api.csfloat.com/v1/loadout/${loadoutId}`]] : []),
    ["GET", "/listings?limit=40&min_ref_qty=20"],
    ["GET", "/listings?limit=5&min_ref_qty=20&type=buy_now&min_price=500"],
    ["GET", "/listings?limit=5&sort_by=most_recent&min_ref_qty=20&type=buy_now&min_price=500"],
    ["GET", "/listings?limit=5&sort_by=most_recent&filter=unique&min_ref_qty=20&type=buy_now&min_price=500"],
    ...(listingId ? [["GET", `/listings/${listingId}`]] : []),
    ...(steamId
      ? [
          ["GET", `/users/${steamId}`],
          ["GET", `/users/${steamId}/stall?limit=1&type=buy_now`],
          ["GET", `/users/${steamId}/stall?limit=1&sort_by=lowest_price`],
          ["GET", `/users/${steamId}/stall?limit=1&filter=unique`],
          ["GET", `/users/${steamId}/stall?limit=1&min_ref_qty=20`],
        ]
      : []),
    ["GET", "/listings/948726619852374910/bids"],
    ["GET", "/listings/948726619852374910/similar"],
    ["GET", "/listings/948726619852374910/buy-orders"],
    ...(marketHashName ? [["GET", `/history/${encodeURIComponent(marketHashName)}/sales`]] : []),
    ["GET", "/history/Souvenir%20P250%20%7C%20Boreal%20Forest%20(Factory%20New)/graph?paint_index=77"],
    // history/graph without paint_index is also public
    ["GET", `/history/${encodeURIComponent("AK-47 | Redline (Field-Tested)")}/graph`],
  ];

  for (const [method, route] of publicRoutes) {
    const result = await publicRequest(method, route);
    summary.public_no_auth_checks.push({
      method,
      route,
      status: result.status,
      ok: result.ok,
      summary: result.ok ? summarizePayload(result.data) : errorSummary(result.data),
    });
  }

  const marketQueryRoutes = [
    ["GET", "/listings?limit=1&min_ref_qty=20"],
    ...(stickerFilterQuery ? [["GET", `/listings?limit=1&stickers=${stickerFilterQuery}`]] : []),
    ...(keychainFilterQuery ? [["GET", `/listings?limit=1&keychains=${keychainFilterQuery}`]] : []),
    ...(stickerFilterQuery
      ? [["GET", `/listings?limit=1&stickers=${stickerFilterQuery}&sticker_option=skins`]]
      : []),
    ["GET", `/listings?limit=1&stickers=${packageProbeStickerFilterQuery}&sticker_option=packages`],
    ["GET", `/listings?limit=1&stickers=${customStickerFilterQuery}`],
  ];

  const extendedMarketQueryRoutes = [
    ["GET", "/listings?limit=1&category=2"],
    ["GET", "/listings?limit=1&category=3"],
    ["GET", "/listings?limit=1&category=4"],
    ["GET", "/listings?limit=1&category=5"],
    ["GET", "/listings?limit=1&collection=set_cobblestone"],
    ["GET", "/listings?limit=1&rarity=6"],
    ["GET", "/listings?limit=1&min_price=10000"],
    ["GET", "/listings?limit=1&max_price=1000"],
    ["GET", "/listings?limit=1&def_index=4&paint_index=437&paint_seed=611"],
    ["GET", "/listings?limit=1&music_kit_index=3"],
    ["GET", "/listings?limit=1&keychain_highlight_reel=1"],
    ["GET", "/listings?limit=1&keychain_index=29&min_keychain_pattern=0&max_keychain_pattern=10"],
    ["GET", "/listings?limit=1&def_index=507&paint_index=38&min_fade=99&max_fade=100"],
    ["GET", "/listings?limit=1&min_blue=90&max_blue=100"],
    // filter enum values — live-confirmed; unauthenticated requests return 403 (not 401)
    ["GET", "/listings?limit=1&filter=sticker_combos"],
    ["GET", "/listings?limit=1&filter=unique"],
    // source string forms — return 200 but all source values are silently ignored on standard accounts (confirmed 2026-03-07 pass 2)
    ["GET", "/listings?limit=1&source=csfloat"],
    ["GET", "/listings?limit=1&source=p2p"],
    // category as real filter (confirmed 2026-03-07)
    ["GET", "/listings?limit=1&def_index=7&paint_index=282&category=2"],
    ["GET", "/listings?limit=1&def_index=7&paint_index=282&category=1"],
    // history/graph category param — accepted (200), slightly different avg_price per day but not a confirmed hard filter
    ["GET", `/history/${encodeURIComponent("AK-47 | Redline (Field-Tested)")}/graph?category=2`],
    ["GET", `/history/${encodeURIComponent("AK-47 | Redline (Field-Tested)")}/graph?category=1`],
  ];

  const activeMarketQueryRoutes = isExtendedScope(config)
    ? marketQueryRoutes.concat(extendedMarketQueryRoutes)
    : marketQueryRoutes;

  for (const [method, route] of activeMarketQueryRoutes) {
    const result = await request(method, route);
    const firstItem = result.data?.data?.[0];

    summary.market_query_checks.push({
      method,
      route,
      status: result.status,
      ok: result.ok,
      summary: result.ok
        ? {
            ...summarizePayload(result.data),
            first_item: firstItem
              ? {
                  id: firstItem.id,
                  market_hash_name: firstItem.item?.market_hash_name,
                  price: firstItem.price,
                }
              : null,
          }
        : errorSummary(result.data),
    });
  }

  const candidateRoutes = [
    // confirmed-dead routes (404) from 2026-03-07 pass 2 kept for regression tracking:
    ["GET", "/me/stall"],
    ["GET", "/me/listings"],
    ["GET", "/account-standing"],
    ["GET", "/notifications?limit=1"],
    ["GET", "/watchlist?limit=1"],
    ["GET", "/bids?limit=1"],
    // /offers GET returns 405 (Method Not Allowed) — POST-only route
    ["GET", "/offers?limit=1"],
    ...(listingId ? [["GET", `/listings/${listingId}/bids`]] : []),
    ["GET", "/listings/950170960026273280/sales"],
    ["GET", "/listings/948726619852374910/sales"],
    ["GET", "/offers/0/history"],
    ["GET", "/trades/0"],
    ["GET", "/trades/0/buyer-details"],
    ["GET", "/buy-orders/item?market_hash_name=AK-47%20%7C%20Redline%20(Field-Tested)"],
    ["GET", "/me/notifications"],
    ["GET", "/me/notification"],
    ["GET", "/me/offer-history?limit=1"],
    ["GET", "/offers/history?limit=1"],
    // listing subroutes — all 404 as of 2026-03-07 pass 2
    ...(listingId ? [
      ["GET", `/listings/${listingId}/offers`],
      ["GET", `/listings/${listingId}/history`],
    ] : []),
  ];

  if (isExtendedScope(config)) {
    for (const [method, route, body] of candidateRoutes) {
      const result = await request(method, route, body);
      summary.candidate_endpoints.push({
        method,
        route,
        status: result.status,
        ok: result.ok,
        summary: result.ok ? summarizePayload(result.data) : errorSummary(result.data),
      });
    }
  }

  const mutationProbeRoutes = [
    ["POST", "/offers", {}],
    ["POST", "/buy-orders", {}],
    ["DELETE", "/buy-orders/0"],
    ["POST", "/listings/bulk-list", {}],
    ["PATCH", "/listings/bulk-modify", { modifications: [{ contract_id: "0", price: 3 }] }],
    ["PATCH", "/listings/bulk-delist", { contract_ids: ["0"] }],
    ["POST", "/listings/buy", { contract_ids: ["0"], total_price: 0 }],
    ["POST", "/listings/sell", {}],
    ["POST", "/me/notifications/read-receipt", { last_read_id: "0" }],
    ["POST", "/trades/bulk/accept", { trade_ids: ["0"] }],
    ["POST", "/trades/bulk/cancel", { trade_ids: ["0"] }],
    ["POST", "/me/trades/bulk/cancel", { trade_ids: ["0"] }],
    ["POST", "/me/mobile/status", {}],
    ["POST", "/me/recommender-token", {}],
    ["POST", "/me/notary-token", {}],
    ["POST", "/me/gs-inspect-token", {}],
    ["POST", "/buy-orders/similar-orders", { market_hash_name: "AK-47 | Redline (Field-Tested)" }],
    [
      "POST",
      "/buy-orders/similar-orders",
      {
        expression: {
          condition: "and",
          rules: [
            { field: "DefIndex", operator: "==", value: { constant: "7" } },
            { field: "PaintIndex", operator: "==", value: { constant: "72" } },
            { field: "StatTrak", operator: "==", value: { constant: "false" } },
            { field: "Souvenir", operator: "==", value: { constant: "false" } },
          ],
        },
      },
    ],
    ["POST", "/listings/950170960026273280/bit", { max_price: 1 }],
    ["DELETE", "/offers/0"],
    ["POST", "/trades/bulk/received", { trade_ids: ["0"] }],
    ["POST", "/trades/notary", {}],
    [
      "POST",
      "/trades/steam-status/new-offer",
      { offer_id: "0" },
    ],
    ["POST", "/trades/steam-status/offer", { sent_offers: [] }],
  ];

  if (config.allowRiskyProbes) {
    mutationProbeRoutes.push(["POST", "/offers/0/counter-offer", {}]);
  }

  let recommenderToken = null;

  for (const [method, route, body] of mutationProbeRoutes) {
    const result = await request(method, route, body);
    if (route === "/me/recommender-token" && result.ok && result.data?.token) {
      recommenderToken = result.data.token;
    }
    summary.mutation_probes.push({
      method,
      route,
      status: result.status,
      ok: result.ok,
      summary: result.ok ? summarizePayload(result.data) : errorSummary(result.data),
    });
  }

  if (recommenderToken) {
    const companionProbeRoutes = [
      ["GET", "user/favorites"],
      [
        "POST",
        "recommend",
        { items: [{ type: "skin", def_index: 7, paint_index: 490 }], count: 5 },
      ],
      [
        "POST",
        "recommend/stickers",
        { items: [{ type: "skin", def_index: 7, paint_index: 490 }], count: 10 },
      ],
      [
        "POST",
        "generate",
        { items: [], def_indexes: [7, 13, 39, 9], faction: "t", max_price: 3000 },
      ],
    ];

    for (const [method, route, body] of companionProbeRoutes) {
      const result = await companionRequest(method, route, recommenderToken, body);
      summary.mutation_probes.push({
        method,
        route: result.route,
        status: result.status,
        ok: result.ok,
        summary: result.ok ? summarizePayload(result.data) : errorSummary(result.data),
      });
    }
  }

  if (config.allowLiveMutations && steamId) {
    const safariMeshExpression = {
      condition: "and",
      rules: [
        { field: "DefIndex", operator: "==", value: { constant: "7" } },
        { field: "PaintIndex", operator: "==", value: { constant: "72" } },
        { field: "StatTrak", operator: "==", value: { constant: "false" } },
        { field: "Souvenir", operator: "==", value: { constant: "false" } },
      ],
    };

    const buyOrderCreate = await request("POST", "/buy-orders", {
      market_hash_name: "Sticker | Aleksib | Paris 2023",
      max_price: 1,
    });

    if (buyOrderCreate.ok && buyOrderCreate.data?.id) {
      const orderId = String(buyOrderCreate.data.id);
      const buyOrderPatch = await request("PATCH", `/buy-orders/${orderId}`, {
        max_price: 2,
      });
      const buyOrderDelete = await request("DELETE", `/buy-orders/${orderId}`);

      summary.mutation_checks.push({
        method: "POST/PATCH/DELETE",
        route: `/buy-orders/${orderId}`,
        status: buyOrderCreate.status,
        ok: buyOrderCreate.ok && buyOrderPatch.ok && buyOrderDelete.ok,
        details: {
          created_price: buyOrderCreate.data?.price,
          patched_price: buyOrderPatch.data?.price,
          delete_summary: buyOrderDelete.ok
            ? summarizePayload(buyOrderDelete.data)
            : errorSummary(buyOrderDelete.data),
        },
      });
    }

    const expressionBuyOrderCreate = await request("POST", "/buy-orders", {
      expression: safariMeshExpression,
      max_price: 3,
      quantity: 1,
    });

    if (expressionBuyOrderCreate.ok && expressionBuyOrderCreate.data?.id) {
      const orderId = String(expressionBuyOrderCreate.data.id);
      const expressionBuyOrderDelete = await request("DELETE", `/buy-orders/${orderId}`);

      summary.mutation_checks.push({
        method: "POST/DELETE",
        route: `/buy-orders/${orderId}`,
        status: expressionBuyOrderCreate.status,
        ok: expressionBuyOrderCreate.ok && expressionBuyOrderDelete.ok,
        details: {
          expression: expressionBuyOrderCreate.data?.expression,
          created_price: expressionBuyOrderCreate.data?.price,
          delete_summary: expressionBuyOrderDelete.ok
            ? summarizePayload(expressionBuyOrderDelete.data)
            : errorSummary(expressionBuyOrderDelete.data),
        },
      });
    }

    const stall = await request("GET", `/users/${steamId}/stall?limit=1&type=buy_now`);
    const trackedListing = stall.ok && stall.data?.data?.[0] ? stall.data.data[0] : null;

    if (trackedListing) {
      const originalPrice = trackedListing.price;
      const trackedListingId = String(trackedListing.id);

      const patchUp = await request("PATCH", `/listings/${trackedListingId}`, {
        price: originalPrice + 1,
      });
      const patchDown = await request("PATCH", `/listings/${trackedListingId}`, {
        price: originalPrice,
      });
      const verify = await request("GET", `/listings/${trackedListingId}`);

      summary.mutation_checks.push({
        method: "PATCH",
        route: `/listings/${trackedListingId}`,
        status: patchUp.status,
        ok: patchUp.ok && patchDown.ok && verify.ok,
        details: {
          original_price: originalPrice,
          after_plus_one: patchUp.data?.price,
          after_revert: patchDown.data?.price,
          verified_price: verify.data?.price,
        },
      });

      const watchlistAdd = await request("POST", `/listings/${trackedListingId}/watchlist`, {});
      const watchlistRemove = await request("DELETE", `/listings/${trackedListingId}/watchlist`);

      summary.mutation_checks.push({
        method: "POST/DELETE",
        route: `/listings/${trackedListingId}/watchlist`,
        status: watchlistAdd.status,
        ok: watchlistAdd.ok && watchlistRemove.ok,
        details: {
          add_summary: watchlistAdd.ok
            ? summarizePayload(watchlistAdd.data)
            : errorSummary(watchlistAdd.data),
          remove_summary: watchlistRemove.ok
            ? summarizePayload(watchlistRemove.data)
            : errorSummary(watchlistRemove.data),
        },
      });
    }

    const inventory = await request("GET", "/me/inventory");
    const fullStall = await request("GET", `/users/${steamId}/stall?limit=500&type=buy_now`);
    const listedAssetIds = new Set((fullStall.data?.data || []).map((entry) => String(entry.item.asset_id)));
    const candidate = (inventory.data || []).find((item) => !listedAssetIds.has(String(item.asset_id)));

    if (candidate) {
      const create = await request("POST", "/listings", {
        asset_id: String(candidate.asset_id),
        price: 9999999,
        type: "buy_now",
      });

      const createDetails = {
        asset_id: String(candidate.asset_id),
        status: create.status,
        ok: create.ok,
        summary: create.ok ? summarizePayload(create.data) : errorSummary(create.data),
      };

      if (create.ok && create.data?.id) {
        const createdId = String(create.data.id);
        const del = await request("DELETE", `/listings/${createdId}`);
        createDetails.delete = {
          status: del.status,
          ok: del.ok,
          summary: del.ok ? summarizePayload(del.data) : errorSummary(del.data),
        };
      }

      summary.mutation_checks.push({
        method: "POST",
        route: "/listings",
        ...createDetails,
      });
    }
  }

  console.log(JSON.stringify(summary, null, 2));
}

main().catch((error) => {
  console.error(error instanceof Error ? error.message : String(error));
  process.exitCode = 1;
});